Egypt's Regulatory Landscape at a Glance
Egypt's framework rests on Law No. 151 of 2020, which established a licensing-based model supervised by a Personal Data Protection Centre. Because the executive regulations that would operationalise the licensing and permit regime have been delayed, practical compliance in Egypt depends heavily on confirming the current implementation position.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Egypt
- Primary data protection framework
- Law No. 151 of 2020 on the Protection of Personal Data
- Implementation status
- Executive regulations and the Personal Data Protection Centre have been delayed; confirm current status
Key Regulations in Egypt
Law No. 151 of 2020
Law No. 151 of 2020 was published in July 2020 and provides Egypt's first comprehensive personal data protection framework. It applies to the electronic processing of personal data by controllers, processors, and holders, covering Egyptian nationals and residents and, in defined circumstances, processing outside Egypt relating to data subjects inside it.
The Law is consent-centric and establishes a licensing and permit model under which certain activities require authorisation from a dedicated Centre rather than only notification.
Depending on applicability, organisations may need to address:
- Consent as the general basis for electronic processing.
- Licences or permits from the Centre for defined activities.
- Appointment of a data protection officer.
- Records of processing activities.
- Security measures appropriate to the risk.
- Breach notification to the Centre and, in some cases, data subjects.
- A permit for transferring personal data outside Egypt.
- Data subject rights including access, correction, and erasure.
Confirm which provisions are operative in practice, as several depend on executive regulations and on the Centre being functional.
The Licensing and Permit Regime
Egypt's most distinctive feature is that the Law requires controllers and processors to obtain licences or permits from the Personal Data Protection Centre for defined activities, rather than simply registering or notifying. Operating without the required authorisation is itself an offence.
Separate permits are contemplated for activities including electronic marketing and the cross-border transfer of personal data, and the categories, procedures, and fees were to be set out in the executive regulations.
Organisations assessing the regime may need to consider:
- Which of their activities fall within the licensing categories.
- Whether a separate permit is required for cross-border transfer.
- Whether electronic marketing requires its own permit.
- The procedures, fees, and renewal periods once set.
- That processing without a required licence is an offence.
This is the central practical uncertainty in Egyptian compliance: the obligation exists in the Law, but the mechanism to obtain authorisation depends on the executive regulations and a functioning Centre.
Implementation Status
The Law contemplated executive regulations to be issued within six months of its entry into force, and the establishment of a Personal Data Protection Centre affiliated to the ministry responsible for communications and information technology to administer the regime.
Both have taken considerably longer than the statutory timetable indicated. The consequence is a framework that is formally in force but whose licensing, permit, and enforcement machinery may not be fully operational.
Organisations should establish, from official sources:
- Whether the executive regulations have been issued and what they require.
- Whether the Personal Data Protection Centre is established and operational.
- Whether licence and permit applications are being accepted and processed.
- How breach notifications should currently be made.
- Whether any transition or grace arrangements apply.
This is the most verification-sensitive page in this set. Treat the operational detail as requiring confirmation before it is relied upon, and do not assume obligations are unenforceable merely because the machinery is incomplete.
Cross-Border Transfers
The Law prohibits transferring, storing, sharing, or making available personal data to a foreign country unless the destination affords a level of protection no less than that provided by the Law, and a permit or licence has been obtained from the Centre.
Limited exceptions apply with the data subject's explicit consent, and in defined circumstances such as protecting life, performing obligations under a judicial procedure, or where required by an international agreement to which Egypt is a party.
Organisations transferring data out of Egypt may need to consider:
- Whether the destination affords an equivalent level of protection.
- Whether the required permit can currently be obtained.
- Whether an exception in the Law applies, including explicit consent.
- Documentation of the basis relied upon.
- Onward transfers by the recipient.
The requirement for both an adequate destination and a permit makes Egypt's transfer regime stricter on paper than most, and the permit limb depends on the Centre being operational.
Sensitive Data, Marketing and Children
Sensitive personal data, which includes data revealing psychological, mental, physical, or genetic health, biometric data, financial data, religious belief, political opinion, and criminal record, requires a licence from the Centre and the data subject's consent.
Electronic marketing is addressed specifically, generally requiring the recipient's consent, clear identification of the sender, and a means of opting out, with records of consent retained. Children's data is subject to additional protection.
Organisations may need to consider:
- Licensing requirements for processing sensitive personal data.
- Consent and identification requirements for electronic marketing.
- Retention of evidence of marketing consent.
- Additional protections applying to children's data.
- That financial data is treated as sensitive in Egypt.
Treating financial data as sensitive personal data is broader than most regimes and brings routine payment and account information into the stricter category.
Sectoral and Related Legislation
Other legislation applies alongside Law 151, including the Telecommunications Regulation Law, the Anti-Cyber and Information Technology Crimes Law, banking secrecy provisions in banking legislation, and the e-commerce and consumer protection frameworks. Health data is subject to additional requirements.
Sectoral considerations may include:
- Telecommunications confidentiality and data retention obligations.
- Cybercrime law provisions on data and systems.
- Banking secrecy requirements and Central Bank expectations.
- Consumer protection and e-commerce requirements.
- Health sector confidentiality rules.
Some of these regimes have been enforced for longer than Law 151 and may be the more immediate practical constraint.
Who Needs to Comply With Egyptian Data Protection Law?
Law No. 151 of 2020 and related requirements may apply to:
Organisations in Egypt
Controllers, processors, and holders electronically processing the personal data of Egyptian nationals or residents.
International companies
Organisations outside Egypt processing personal data of data subjects inside Egypt in the circumstances the Law specifies.
Processors
Service providers processing on a controller's behalf, which have their own obligations and licensing exposure under the Law.
Organisations needing licences
Entities whose activities fall within the licensing or permit categories, including sensitive data processing and cross-border transfers.
Employers
Organisations handling employee data, including health and financial information treated as sensitive under the Law.
Senders of electronic marketing
Businesses conducting electronic marketing to recipients in Egypt, which the Law addresses specifically.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under Law 151
Consent and Lawful Processing
Electronic processing of personal data generally requires the data subject's consent, which must be explicit for sensitive personal data. The Law sets out limited circumstances in which processing may proceed without consent, including where required to perform a legal obligation or protect vital interests.
Egypt relies on consent more heavily than regimes with a broad set of lawful bases, so consent capture and evidence matter.
Licences and Permits
Controllers and processors must obtain the licences or permits the Law requires for their activities from the Personal Data Protection Centre, including for processing sensitive personal data, electronic marketing, and cross-border transfers. Operating without a required authorisation is an offence.
Whether and how applications can currently be made depends on the executive regulations and the Centre's operational status.
Data Protection Officer
Controllers and processors must appoint a data protection officer responsible for applying the Law, receiving requests, maintaining records, and acting as the point of contact with the Centre. The officer is to be registered with the Centre.
The Law frames this as a general requirement rather than one triggered by thresholds, which is stricter than many regimes.
Records and Security
Records of processing activities must be maintained, and technical and organisational measures taken to protect personal data from loss, unlawful access, alteration, and disclosure, proportionate to the nature of the data and the risk.
Breach Notification
A breach or violation affecting personal data must be notified to the Centre within seventy-two hours of becoming aware of it, and where the breach relates to national security the period is shorter. Data subjects must be notified where the breach affects their data in the circumstances the Law specifies.
Confirm the notification channel, as it depends on the Centre being operational.
Cross-Border Transfers
Transferring, storing, sharing, or making personal data available to a foreign country requires that the destination afford protection no less than the Law provides and that a permit be obtained, unless an enumerated exception applies.
Data Subject Rights Under Law 151
Law No. 151 of 2020 gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Be Informed
Data subjects have the right to know about and be notified of the processing of their personal data held by a controller or processor.
Right of Access
Data subjects may access and obtain their personal data held by a controller or processor.
Correction and Completion
Data subjects may request correction, amendment, or completion of their personal data.
Erasure
Data subjects may request deletion or removal of their personal data, subject to the exceptions in the Law.
Withdrawal and Objection
Data subjects may withdraw consent to retention or processing, and may object to processing where it conflicts with their rights.
Knowledge of Disclosure
Data subjects may be informed of any breach or violation affecting their personal data, in the circumstances the Law specifies.
The Law sets periods for responding to requests and permits a fee in defined circumstances; the detail depends on the executive regulations.
Egypt's Regulatory Timeline
Egypt legislated in 2020, but implementation has lagged the statutory timetable.
- July 2020
Law No. 151 Published
Egypt's first comprehensive personal data protection law was published, establishing a licensing-based model and a dedicated Centre.
- October 2020
Law Enters Into Force
The Law came into force, with executive regulations contemplated to follow within six months to operationalise its requirements.
- 2021 onwards
Regulations Delayed
The executive regulations were not issued within the contemplated period, leaving the licensing, permit, and procedural machinery incomplete.
- Current
Status To Be Confirmed
The issuance of executive regulations and the operational status of the Personal Data Protection Centre should be verified from official sources.
Important: this page describes a framework that is formally in force but whose implementing machinery has been delayed. Confirm the current position before relying on any operational detail, and do not assume obligations are unenforceable.
Data Protection Authorities in Egypt
Law No. 151 provides for a Personal Data Protection Centre, affiliated to the ministry responsible for communications and information technology, with functions including issuing licences and permits, setting standards, receiving complaints and breach notifications, supervising compliance, and imposing or recommending sanctions.
Other authorities are relevant in practice, including the National Telecommunications Regulatory Authority, the Central Bank of Egypt for banking data, and law enforcement bodies for offences under the cybercrime legislation. Several of these regimes have been operative longer than Law 151.
Establish which body is currently handling data protection matters in practice, as this depends on the Centre's operational status.
Penalties for Non-Compliance
Law No. 151 relies on criminal penalties rather than administrative fines. It creates offences for conduct including processing personal data without the required licence or permit, unlawfully disclosing personal data, transferring data abroad in breach of the Law, failing to notify a breach, and obstructing the Centre, with penalties comprising fines and, for several offences, imprisonment.
Penalties are generally more severe where sensitive personal data is involved, and responsible officers of a legal person may face personal liability where a violation results from their failure to supervise. Because the applicable amounts and the procedures for imposing them interact with the executive regulations, this page does not quote figures; exposure should be assessed against current official sources.
How RegulatoryBridge Supports Compliance in Egypt
RegulatoryBridge helps organisations assess Egypt's regulatory requirements and coordinate their compliance activities with wider international programmes.
Law 151 Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Data Protection Officer and Licensing Assessment
Review the data protection officer appointment the Law requires, and which licences or permits your processing and transfer activities would need from the Centre.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and Data Protection Centre Notification
Evaluate breach assessment procedures, escalation responsibilities, Data Protection Centre notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess cross-border transfers, which under the Law require a permit from the Centre in addition to an adequate level of protection at the destination.
Sectoral Compliance Coordination
Help organise requirements across Law 151, telecommunications regulation, banking secrecy, the e-commerce framework, and health sector rules.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, Data Protection Centre guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Egypt Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Egypt.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Egypt Compliance
Need Egyptian data protection support?
We help establish what is currently operative, and support your data protection officer, licensing, and transfer arrangements - so your global product team doesn't have to.